formbook | cddef48cbafa5561f43fd788cfc08215af2c8c4d700bbad363c467e60ad0eda1

General

Target
4109d451b2fd5b3b7db60f8c72331c78.exe
Size 732KB
Sample200904-e7jlyxzbd2
SHA256 cddef48cbafa5561f43fd788cfc08215af2c8c4d700bbad363c467e60ad0eda1
MD5 4109d451b2fd5b3b7db60f8c72331c78
SHA1 446fac74df877fbc79d0a84d3add552d062523c2
SHA512 6ea5a5b30f5d4723d751c92f6a6076515bb9ec8f77929962901b67babd2e2fde9c91ff7623cd3ce7d2b4007a5cd796efbe4baba146967b2fd9931ce7178f14cd
MD5 SHA1 SHA512

Score

10^/10

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3484-1-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3484-1-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral2/memory/3484-2-0x000000000041EB40-mapping.dmp	formbook

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 3484	3672	4109d451b2fd5b3b7db60f8c72331c78.exe	72

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 75a03c317882d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3672	4109d451b2fd5b3b7db60f8c72331c78.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	640	svchost.exe
Token: SeCreatePagefilePrivilege	640	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3484	3672	4109d451b2fd5b3b7db60f8c72331c78.exe	72
PID 3672 wrote to memory of 3484	3672	4109d451b2fd5b3b7db60f8c72331c78.exe	72
PID 3672 wrote to memory of 3484	3672	4109d451b2fd5b3b7db60f8c72331c78.exe	72

C:\Users\Admin\AppData\Local\Temp\4109d451b2fd5b3b7db60f8c72331c78.exe
"C:\Users\Admin\AppData\Local\Temp\4109d451b2fd5b3b7db60f8c72331c78.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\4109d451b2fd5b3b7db60f8c72331c78.exe
  "C:\Users\Admin\AppData\Local\Temp\4109d451b2fd5b3b7db60f8c72331c78.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

memory/3484-1-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3672-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Download